Analysis
-
max time kernel
119s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/01/2025, 18:52
Behavioral task
behavioral1
Sample
685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe
Resource
win10v2004-20241007-en
General
-
Target
685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe
-
Size
2.9MB
-
MD5
3157c0db6a2a525066097e2d16135e00
-
SHA1
6e10abe58294afde663af7323b867a814978ebcb
-
SHA256
685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6
-
SHA512
5de54b5683ef2b779efde7fd8046391f5f8466807bc47dcf1200a33de6e80d1893f369c68802414e5d808648a43608118e6bd6c312a97498fb58151910997077
-
SSDEEP
24576:eTy7ASmZZcVKfIxTiEVc847flVC6faaQDbGV6eH81k6IbGD2JTu0GoZQDbGV6eHt:eTy7ASmw4gxeOw46fUbNecCCFbNec6
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "C:\\Windows\\explorer.exe, c:\\windows\\system\\explorer.exe" explorer.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" explorer.exe -
WarzoneRat, AveMaria
WarzoneRat is a native RAT developed in C++ with multiple plugins sold as a MaaS.
-
Warzonerat family
-
Warzone RAT payload 4 IoCs
resource yara_rule behavioral2/files/0x0009000000023cb2-32.dat warzonerat behavioral2/files/0x0008000000023cb0-58.dat warzonerat behavioral2/files/0x0004000000000713-74.dat warzonerat behavioral2/files/0x0004000000000713-287.dat warzonerat -
Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666} explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{Y479C6D0-OTRW-U5GH-S1EE-E0AC10B4E666}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\mrsys.exe MR" explorer.exe -
Drops startup file 19 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe -
Executes dropped EXE 37 IoCs
pid Process 2492 explorer.exe 2220 explorer.exe 1932 explorer.exe 4452 spoolsv.exe 4812 spoolsv.exe 760 spoolsv.exe 4620 spoolsv.exe 3056 spoolsv.exe 1836 spoolsv.exe 4084 spoolsv.exe 3900 spoolsv.exe 1960 spoolsv.exe 5016 spoolsv.exe 3688 spoolsv.exe 2816 spoolsv.exe 2904 spoolsv.exe 2948 spoolsv.exe 2680 spoolsv.exe 1992 spoolsv.exe 2744 spoolsv.exe 1964 spoolsv.exe 2352 spoolsv.exe 1760 spoolsv.exe 684 spoolsv.exe 1564 spoolsv.exe 2876 spoolsv.exe 3256 spoolsv.exe 4472 spoolsv.exe 4116 spoolsv.exe 440 spoolsv.exe 2476 spoolsv.exe 2888 spoolsv.exe 4376 spoolsv.exe 3712 spoolsv.exe 1592 spoolsv.exe 4432 spoolsv.exe 1080 spoolsv.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe Set value (str) \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Explorer = "c:\\windows\\system\\explorer.exe RO" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\Svchost = "c:\\windows\\system\\svchost.exe RO" explorer.exe -
Suspicious use of SetThreadContext 23 IoCs
description pid Process procid_target PID 760 set thread context of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 2664 set thread context of 4628 2664 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 102 PID 2664 set thread context of 1292 2664 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 103 PID 2492 set thread context of 2220 2492 explorer.exe 107 PID 2220 set thread context of 1932 2220 explorer.exe 108 PID 2220 set thread context of 2268 2220 explorer.exe 109 PID 4452 set thread context of 4812 4452 spoolsv.exe 113 PID 760 set thread context of 4620 760 spoolsv.exe 117 PID 3056 set thread context of 1836 3056 spoolsv.exe 121 PID 4084 set thread context of 3900 4084 spoolsv.exe 125 PID 1960 set thread context of 5016 1960 spoolsv.exe 129 PID 3688 set thread context of 2816 3688 spoolsv.exe 133 PID 2904 set thread context of 2948 2904 spoolsv.exe 137 PID 2680 set thread context of 1992 2680 spoolsv.exe 141 PID 2744 set thread context of 1964 2744 spoolsv.exe 145 PID 2352 set thread context of 1760 2352 spoolsv.exe 149 PID 684 set thread context of 1564 684 spoolsv.exe 153 PID 2876 set thread context of 3256 2876 spoolsv.exe 157 PID 4472 set thread context of 4116 4472 spoolsv.exe 161 PID 440 set thread context of 2476 440 spoolsv.exe 165 PID 2888 set thread context of 4376 2888 spoolsv.exe 169 PID 3712 set thread context of 1592 3712 spoolsv.exe 173 PID 4432 set thread context of 1080 4432 spoolsv.exe 177 -
Drops file in Windows directory 21 IoCs
description ioc Process File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\spoolsv.exe spoolsv.exe File opened for modification \??\c:\windows\system\explorer.exe 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 58 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language spoolsv.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 4628 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 4628 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 2492 explorer.exe 2492 explorer.exe 4452 spoolsv.exe 4452 spoolsv.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 1932 explorer.exe 760 spoolsv.exe 760 spoolsv.exe 1932 explorer.exe 1932 explorer.exe 3056 spoolsv.exe 3056 spoolsv.exe 1932 explorer.exe 1932 explorer.exe 4084 spoolsv.exe 4084 spoolsv.exe 1932 explorer.exe 1932 explorer.exe 1960 spoolsv.exe 1960 spoolsv.exe 1932 explorer.exe 1932 explorer.exe 3688 spoolsv.exe 3688 spoolsv.exe 1932 explorer.exe 1932 explorer.exe 2904 spoolsv.exe 2904 spoolsv.exe 1932 explorer.exe 1932 explorer.exe 2680 spoolsv.exe 2680 spoolsv.exe 1932 explorer.exe 1932 explorer.exe 2744 spoolsv.exe 2744 spoolsv.exe 1932 explorer.exe 1932 explorer.exe 2352 spoolsv.exe 2352 spoolsv.exe 1932 explorer.exe 1932 explorer.exe 684 spoolsv.exe 684 spoolsv.exe 1932 explorer.exe 1932 explorer.exe 2876 spoolsv.exe 2876 spoolsv.exe 1932 explorer.exe 1932 explorer.exe 4472 spoolsv.exe 4472 spoolsv.exe 1932 explorer.exe 1932 explorer.exe 440 spoolsv.exe 440 spoolsv.exe 1932 explorer.exe 1932 explorer.exe -
Suspicious use of SetWindowsHookEx 44 IoCs
pid Process 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 4628 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 4628 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 2492 explorer.exe 2492 explorer.exe 1932 explorer.exe 1932 explorer.exe 4452 spoolsv.exe 4452 spoolsv.exe 1932 explorer.exe 1932 explorer.exe 760 spoolsv.exe 760 spoolsv.exe 3056 spoolsv.exe 3056 spoolsv.exe 4084 spoolsv.exe 4084 spoolsv.exe 1960 spoolsv.exe 1960 spoolsv.exe 3688 spoolsv.exe 3688 spoolsv.exe 2904 spoolsv.exe 2904 spoolsv.exe 2680 spoolsv.exe 2680 spoolsv.exe 2744 spoolsv.exe 2744 spoolsv.exe 2352 spoolsv.exe 2352 spoolsv.exe 684 spoolsv.exe 684 spoolsv.exe 2876 spoolsv.exe 2876 spoolsv.exe 4472 spoolsv.exe 4472 spoolsv.exe 440 spoolsv.exe 440 spoolsv.exe 2888 spoolsv.exe 2888 spoolsv.exe 3712 spoolsv.exe 3712 spoolsv.exe 4432 spoolsv.exe 4432 spoolsv.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 760 wrote to memory of 4036 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 83 PID 760 wrote to memory of 4036 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 83 PID 760 wrote to memory of 4036 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 83 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 760 wrote to memory of 2664 760 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 85 PID 2664 wrote to memory of 4628 2664 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 102 PID 2664 wrote to memory of 4628 2664 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 102 PID 2664 wrote to memory of 4628 2664 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 102 PID 2664 wrote to memory of 4628 2664 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 102 PID 2664 wrote to memory of 4628 2664 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 102 PID 2664 wrote to memory of 4628 2664 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 102 PID 2664 wrote to memory of 4628 2664 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 102 PID 2664 wrote to memory of 4628 2664 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 102 PID 2664 wrote to memory of 1292 2664 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 103 PID 2664 wrote to memory of 1292 2664 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 103 PID 2664 wrote to memory of 1292 2664 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 103 PID 2664 wrote to memory of 1292 2664 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 103 PID 2664 wrote to memory of 1292 2664 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 103 PID 4628 wrote to memory of 2492 4628 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 104 PID 4628 wrote to memory of 2492 4628 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 104 PID 4628 wrote to memory of 2492 4628 685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe 104 PID 2492 wrote to memory of 3172 2492 explorer.exe 105 PID 2492 wrote to memory of 3172 2492 explorer.exe 105 PID 2492 wrote to memory of 3172 2492 explorer.exe 105 PID 2492 wrote to memory of 2220 2492 explorer.exe 107 PID 2492 wrote to memory of 2220 2492 explorer.exe 107 PID 2492 wrote to memory of 2220 2492 explorer.exe 107 PID 2492 wrote to memory of 2220 2492 explorer.exe 107 PID 2492 wrote to memory of 2220 2492 explorer.exe 107 PID 2492 wrote to memory of 2220 2492 explorer.exe 107 PID 2492 wrote to memory of 2220 2492 explorer.exe 107 PID 2492 wrote to memory of 2220 2492 explorer.exe 107 PID 2492 wrote to memory of 2220 2492 explorer.exe 107 PID 2492 wrote to memory of 2220 2492 explorer.exe 107 PID 2492 wrote to memory of 2220 2492 explorer.exe 107 PID 2492 wrote to memory of 2220 2492 explorer.exe 107 PID 2492 wrote to memory of 2220 2492 explorer.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe"C:\Users\Admin\AppData\Local\Temp\685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4036
-
-
C:\Users\Admin\AppData\Local\Temp\685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exeC:\Users\Admin\AppData\Local\Temp\685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664 -
C:\Users\Admin\AppData\Local\Temp\685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exeC:\Users\Admin\AppData\Local\Temp\685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6N.exe3⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4628 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2492 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3172
-
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
PID:2220 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe6⤵
- Modifies WinLogon for persistence
- Modifies visiblity of hidden/system files in Explorer
- Boot or Logon Autostart Execution: Active Setup
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1932 -
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4452 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4440
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4812
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:760 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1548
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4620
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3056 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1140
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1836
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4084 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:5104
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3900
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1960 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1080
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:5016
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:3688 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4276
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2816
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2904 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:368
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2948
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2680 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1572
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1992
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2744 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2496
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1964
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2352 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1828
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1760
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:1376
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1564
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4360
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3256
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4472 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:2360
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4116
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:540
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2476
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:2888 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:3868
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4376
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:3712 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4124
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1592
-
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe SE7⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:4432 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\spoolsv.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"8⤵
- Drops startup file
- System Location Discovery: System Language Discovery
PID:4828
-
-
\??\c:\windows\system\spoolsv.exec:\windows\system\spoolsv.exe8⤵
- Executes dropped EXE
PID:1080
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"6⤵PID:2268
-
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:1292
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
3Active Setup
1Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Defense Evasion
Hide Artifacts
1Hidden Files and Directories
1Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.9MB
MD53157c0db6a2a525066097e2d16135e00
SHA16e10abe58294afde663af7323b867a814978ebcb
SHA256685ba99f14a65fabc0eae36f1793756403226c6751f0c6bf21f7a036e50446f6
SHA5125de54b5683ef2b779efde7fd8046391f5f8466807bc47dcf1200a33de6e80d1893f369c68802414e5d808648a43608118e6bd6c312a97498fb58151910997077
-
Filesize
93B
MD58445bfa5a278e2f068300c604a78394b
SHA19fb4eef5ec2606bd151f77fdaa219853d4aa0c65
SHA2565ddf324661da70998e89da7469c0eea327faae9216b9abc15c66fe95deec379c
SHA5128ad7d18392a15cabbfd4d30b2e8a2aad899d35aba099b5be1f6852ca39f58541fb318972299c5728a30fd311db011578c3aaf881fa8b8b42067d2a1e11c50822
-
Filesize
92B
MD513222a4bb413aaa8b92aa5b4f81d2760
SHA1268a48f2fe84ed49bbdc1873a8009db8c7cba66a
SHA256d170ac99460f9c1fb30717345b1003f8eb9189c26857ca26d3431590e6f0e23d
SHA512eee47ead9bef041b510ee5e40ebe8a51abd41d8c1fe5de68191f2b996feaa6cc0b8c16ed26d644fbf1d7e4f40920d7a6db954e19f2236d9e4e3f3f984f21b140
-
Filesize
2.9MB
MD5f48eeaf98053f132894b8bd9e1b2e8d8
SHA18fdb872b91e80d59c8a5605702233a1ec29565c9
SHA256033ceb7c683af372c8072faa251781285c2c58b1f6a939d31c8eae819fc694dc
SHA5121876900e5ca15721330573bfdcc0c143fa2c436992698c61124a44810053b847fcfc8ea7283c0c691d7f4c9dcda769f55392c9d397ae205210b376e0cf408a55
-
Filesize
2.3MB
MD5b6bd73ed938444eda3e65f7aafc97130
SHA13a61fb37bb1b1d562f8dca901c072e11563a5bb9
SHA2561bd650f86ee85e8d91ad787f5a0887d9e550dd9fe61c88a4ee890cfd423e2534
SHA51227fe345d979f9e070d402334af0a7b46b1cc228c49a5f7501349e7b7dc5a175bd18080c37d7d8bf5acd6454581be78b81de14f4828fa6c209026c19469c3006e
-
Filesize
2.9MB
MD5977726bec75f8e8cd0e951a3e4782854
SHA18f9b3ced861b0a2f5b360636fa2523c53d048b88
SHA256253b491a5a4835498a7c46cf6ab82b149fc19753fa41e4c3d4989650ed37ad04
SHA512e7b9625e642bec6facecd71acef3f53887f67b1fd04c732b59321cb53f5b5511ceffee43ae85c22f7c7634eea0d393e237ee43dddd3596672b86c6438828ce2d